Give every CommitLore surface one runtime identity

[MongLong0214]

Summary

Closes F-001 (P0). Addresses the convergence half of #633, #634 and #635.

Every execution surface answers to the name commitlore, and nothing established that they were the same program. Measured on one machine:

PATH CLI            0.8.2
Git hook pin        0.8.0
Claude plugin cache 0.8.0
Codex plugin cache  0.8.2
MCP asset lookup    0.6.0 or a dev-<hash> root that no longer exists
Index writer        schema v4
MCP reader          schema v3

A shared runtime identity — version, entrypoint, package root, index schema — is now produced by one function, reported by each surface, and compared by doctor in a single report.

RED, verified independently against unmodified main

The delegated report offered a failing test run as its RED, but those failures were module-resolution errors: the tests could not load a file that does not exist on main yet. That proves nothing about the defect, so the RED was re-established by hand.

On main, a repository whose hook pin names an older install:

fail  hook runtime — the hook exited 1 under the restricted PATH — cause unclear:
      commitlore: cannot find the CLI this hook was installed with.

cause unclear. The version mismatch is the cause, and the user is not told.

On this branch, same repository, same state:

warn  runtime identity — hook identity differs from CLI:
      hook v0.8.0; entry …/v0.8.0/dist/commitlore.mjs; root …/v0.8.0; schema v4
      CLI  v0.8.2; entry …/wt-f001/dist/commitlore.mjs; root …/wt-f001; schema v4
      fix: commitlore hooks install

A false positive, found and removed

The first implementation compared entrypoint filenames, so it warned on a correct installation: one install ships both dist/commitlore.mjs and dist/cli.js, and a hook recorded against one while the CLI runs from the other is the same install reached two ways.

A check that fires on a healthy machine stops being believed, which would have cost more than the defect it reports. Convergence is now decided on the installation — package root, version, index schema — with the entrypoint kept in the report because it is what a person needs when the roots genuinely differ.

Verified by hand in both directions:

scenario	result
two entrypoints inside one root	ok
a genuinely older install	warn, naming both roots, with the fix line

Scope

Runtime identity only. Capture asset readiness is F-002 (#641) and trust-grade equivalence across routes is F-003; neither is touched here. No daemon, no hosted service, no new database — the existing shared core, doctor registry and hooks carry it.

Test plan

• runtime-identity, doctor, hooks, index-db: 123 cases
• doctor and init together: 96 cases
• init: 24 · doctor: 72
• npx tsc --noEmit
• Canonical build, manifest refreshed, npm run artifact:verify
• Clean-install / upgrade / rollback walk with identity agreeing after each

The pinned doctor check list and count moved 16 → 17 for the added check, which is what those assertions exist to make visible.

[github-actions]

CommitLore — record lint

Trailers: clean — 6 commits in origin/main..5ce45604d08151ce71ad08c8ba47d62ffd12e5f4
Active constraints: not read — commitlore: git log --follow accepts exactly one pathspec, so renames are not followed for 44 paths; query one path at a time to follow its rename chain (44 changed paths)

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}